Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties

It wasn’t long ago that we uncovered compromised extensions on Open VSX. Now, a new wave of attacks is emerging, and all signs point to the same threat actor. The technique will sound familiar: hidden malicious code injected with invisible Unicode Private Use Area (PUA) characters. We first saw this trick back in March when npm packages used PUAs to conceal payloads. Then came Open VSX. Now, the attacker seems to have turned their sights on GitHub, and their methods are evolving.

Same Adversary, New Terrain: Adapting an Endpoint Detection Mindset to the Cloud

In their talk, Katie Nickels (Sr. Director of Intelligence Operations) and Jesse Griggs (Sr. Threat Researcher) from Red Canary show you how to adapt an endpoint detection mindset to the cloud, specifically focusing on pre-impact TTPs and building robust cloud detections.

Datadog Detect (October 30, 2025)

Datadog Detect is a virtual mini-conference dedicated to helping security teams modernize detection and response by applying engineering best practices. Hear talks from industry experts, including security researchers and engineers at Datadog, Red Canary, and Corelight to learn about building scalable, effective security operations.

The Goldilocks Approach: Finding Detections That Are Just Right

In this talk, Megan Roddie-Fonseca, Sr. Security Engineer at Datadog, addresses the challenge of finding "just right" detections, leveraging data classification techniques like recall and precision to balance false positives and missed attacks. Presented on October 30, 2025 for Datadog Detect.

Silence of the Daemons: Why Evasion Isn't About Location and NDR's Role in the Cloud

In this talk, David Burkett, Cloud Security Researcher at Corelight, highlights how timeless evasion tactics create critical blind spots in cloud workloads, and illustrates the role of Network Detection and Response (NDR) as a resilient countermeasure. Presented on October 30, 2025 for Datadog Detect.

The State of Application Security in Financial Services: Managing Security Debt

Application security in financial services is essential to maintaining trust, compliance, and operational resilience in a rapidly evolving digital landscape. Financial services organizations must balance innovation with holistic security controls, especially as the pressure to launch new digital solutions grows. The evidence is clear: challenges around “security debt,” unresolved flaws left in production for over a year, pose material risk to the sector.

Mend.io Expands AI Native AppSec to Windsurf, CoPilot, Claude Code, and Amazon Q Developer

Today, Mend.io is expanding its AppSec capabilities to secure the five most popular agentic IDEs — including Windsurf, CoPilot, Claude Code, Amazon Q Developer, and Cursor — ensuring that developers can move at AI speed without compromising security.

Increasing Agility & Flexibility: How Mercato Solutions tackles the application security vs. flexibility conundrum with Snyk

Company overview: Mercato Solutions is one of EMEAs fastest growing and most innovative low-code enterprise application providers. Champion / Spokesperson: Neil Tonkin, CTO Mercato Solutions is one of EMEAs fastest growing and most innovative low-code enterprise application providers. The company helps their global clients transform their business processes with bespoke and branded software platforms, applications, and cloud environments that help work flow more efficiently and effectively.

Why Security Can Be Stricter: A Zero Trust Approach to AppSec with AI | Mend.io

Is AI making application security easier or harder? We spoke to Amit Chita, Field CTO at Mend.io, the rise of AI agents in the Software Development Lifecycle (SDLC) presents a unique opportunity for security teams to be stricter than ever before. As developers increasingly use AI agents and integrate LLMs into applications, the attack surface is evolving in ways traditional security can't handle. The only way forward is a Zero Trust approach to your own AI models. Join Ashish Rajan and Amit Chita as they discuss the new threats introduced by AI and how to build a resilient security program for this new era.

Securing AI Applications in the Cloud: Shadow AI, RAG & Real Risks | Mend.io

What does it take to secure AI-based applications in the cloud? In this episode, host Ashish Rajan sits down with Bar-el Tayouri, Head of Mend AI at Mend.io, to dive deep into the evolving world of AI security. From uncovering the hidden dangers of shadow AI to understanding the layers of an AI Bill of Materials (AIBOM), Bar-el breaks down the complexities of securing AI-driven systems. Learn about the risks of malicious models, the importance of red teaming, and how to balance innovation with security in a dynamic AI landscape. What is an AIBOM and why it matters The stages of AI adoption.

Automate Security Response with Datadog Workflow Automation

Responding to threats often requires time-consuming, multi-step actions across multiple tools, slowing down investigations and increasing risk. Learn how security teams can automate a wide range of workflows, from everyday tasks to complex, multi-step investigations, so they can streamline response and reduce manual effort across tools and environments. In this demo, see how Datadog’s integrated SOAR, powered by Workflow Automation, helps you build, test, and manage automated security playbooks with confidence.

Aikido + Secureframe: Keeping compliance data fresh

TL;DR: Aikido now integrates with Secureframe. Vulnerability data syncs automatically so SOC 2 Type 2 and ISO 27001:2022 evidence stays accurate. 16 tests and 5 controls handled for you. Secureframe makes it easier to run SOC 2, ISO 27001, HIPAA and PCI DSS programs. But compliance tools only work if the data inside them is accurate. Too often, teams end up exporting CSVs, uploading reports, or sharing screenshots that are already outdated by the time an auditor looks at them.

The AppSec Bottleneck: Why Fixing Can't Wait

Vulnerability detection isn’t the main problem - remediation is. In today’s fast-paced development world, security teams are overwhelmed with alerts, while developers struggle to keep up with security tasks that feel disconnected from their workflow. The real risk? Vulnerabilities that sit unaddressed in a growing backlog. Join Daniel Wyrzykowski, Product Manager at Mend.io and Saoirse Hinksmon, Senior Product Marketing Manager at Mend.io as they explore.

Futurize, Unite, and Simplify Application Security: A Black Hat Discussion

In this video from Black Hat 2025, A10 Networks security expert Jamiso Utter explains the critical need to "futurize our defenses." He argues that many current cybersecurity solutions, such as firewalls and Regex, are built on decades-old technology, making them ill-equipped to handle today's emerging threats. Jamison highlights the problem with buying from companies whose "bottom line is more important than your bottom line," leading to a fragmented "best-of-breed" approach that ultimately adds complexity to a network.

CIS Control 16: Application Software Security

Modern IT environments typically include a wide range of applications: software developed in house, hosted software platforms, open-source tools and purchased solutions. Because these applications access sensitive systems, data and other IT assets, cybercriminals are eager to exploit them during attacks.

Veracode Crowned a Leader in the Q3 2025 Forrester Wave for SAST

Discover why Veracode was named a leader in the Q3 2025 Forrester Wave report on Static Application Security Testing (SAST) solutions. Key Highlights from the Report: Unmatched Detection Power: Spot vulnerabilities with precision and virtually zero false positives, keeping your code clean and secure. Developer-First Fixes: Say goodbye to workflow disruptions with Veracode Fix – automated remediation in IDEs and pull requests that lets devs fix issues on the fly.

The Business Case for Investing in AppSec Tools

Relying on disjointed, manual security processes creates bottlenecks that delay software releases and increase business risk. As development accelerates, security teams struggle to keep pace, leading to a rise in security debt and a greater likelihood of breaches. Investing in the right AppSec tools is no longer a technical decision; it is a strategic business imperative.

Elevate Application Security from the Start with Static Analysis for Effective Risk Management

Securing your applications couldn’t be more important in today’s fast-moving world of software development. Organizations face mounting pressure to deliver innovative software at an accelerated pace, yet this speed must never compromise security. This is where DevSecOps becomes crucial. With threats constantly getting smarter, developers need effective tools to write secure code right from the start.

Proven Best Practices for Safer Code that Work: AppSec for the Win | Webinar Mend.io

In this session, Chris Lindsey discusses proven best practices for building a robust AppSec program, offering actionable insights for both developers and security teams. Chris, with over 35 years of experience in software development and 15+ years in security, shares strategies that helped him run a successful security program.

Beyond Traditional AppSec: Navigating the New Frontier of AI Security with Mend AI

Hear from Bar-El Tayouri, Head of Mend AI, about the urgent need for a new approach to securing AI-driven applications. From understanding novel AI components and their risks to implementing a comprehensive AppSec program, this episode provides actionable insights for organizations building with AI.